Webhooks and Authentication

Use app credentials for server-to-server API calls and signed webhooks for event-driven workflows. Credentials are scoped to one workspace and environment; never reuse a production token in test.

Authentication checklist

• Create or install the integration from the workspace Dashboard.
• Request only the permissions the integration needs.
• Store tokens in a secret manager and keep them out of browser code and logs.
• Validate the expected BoxNCase API URL before accepting an installation.
• Rotate a token immediately if it may have been exposed.

See Authentication and App permissions.

Webhook delivery

1. Expose a public HTTPS endpoint with a valid certificate.
2. Verify the webhook signature before parsing or acting on the payload.
3. Return a successful response quickly, then process longer work asynchronously.
4. Make handlers idempotent because an event can be delivered more than once.
5. Record event identifiers, attempts, and terminal failures without logging secrets.

Common subscriptions include product and inventory changes, order creation and updates, fulfillment, and tracking changes. Choose only the events needed by the integration.

For event types, payloads, retry behavior, and signature validation, see Webhooks.